ad-ldap-attack

Active Directory LDAP enumeration uses authenticated domain credentials to query the directory for users, groups, SPNs, and trusts. Tools like ldapsearch and ldapdomaindump extract and export domain structure data for security assessments.

Mapping attack paths to Domain Admins uses BloodHound to ingest LDAP enumeration data and visualize lateral movement routes. This reveals ACL misconfigurations and trust relationships exploitable during internal red-team engagements.

AS-REP roasting harvests credential artifacts by requesting authentication tickets for accounts with pre-authentication disabled. The extracted hashes are then audited offline to identify weak passwords within the domain environment.

Yes, authenticated access or valid domain credentials are required to query AD LDAP services. This access enables security assessments to retrieve domain objects and extract credential artifacts using Impacket and related tooling.

Impacket supports collecting SPN-based tickets during Active Directory assessments. It extracts Service Principal Name tickets from the domain for offline cracking to audit credential weaknesses in authorized engagements.

LDAP queries require network access to domain controllers and authenticated domain accounts. Reconnaissance is limited by ACLs governing the querying user, meaning unprivileged accounts may not reveal sensitive trust configurations or DCSync data.